cve/2021/CVE-2021-24727.md

### [CVE-2021-24727](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24727)
![](https://img.shields.io/static/v1?label=Product&message=WP%20Block%20and%20Stop%20Bad%20Bots%20Crawlers%20and%20Spiders%20and%20Anti%20Spam%20Protection%20Plugin%20StopBadBots&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=6.60%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen)

### Description

The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections

### POC

#### Reference
- https://wpscan.com/vulnerability/ffa1f718-f2c5-48ef-8eea-33a18a628a2c
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29174

#### Github
- https://github.com/20142995/nuclei-templates